BMW act fast to plug car security leak

Fleet operators and luxury car owners can rest easier in their beds tonight, as BMW have fixed a fault in their security systems that could have seen millions of their cars unlocked.

We’re not talking figuratively either, as the bug in question not only made the doors of BMW models vulnerable, but also those of the other brands that the German manufacturer owns, such as Mini and Rolls Royce.

The problem centered around the company’s ConnectedDrive software, which uses SIM cards to recognize a mobile device’s authorised users. Connecting a phone lets drivers access real time traffic information, control the car’s entertainment system and air conditioning and, crucially, unlock the car remotely. The actual security risk occurred when data was transmitted from the SIM.

The issue was flagged up by the German motorist association, ADAC, who set up a false mobile network to trick the cars into granting them access. BMW, however, have been quick to point out that they are unaware of any examples on the roads where cars had been compromised because of the fault.

Steps have now been taken to plug the gaps in security by encrypting the communications inside the car, with BMW rolling out the same HTTPS standard used for web transactions and ecommerce. To make life easier for owners, the manufacturer is able to update its ConnectedDrive software remotely and automatically so long as the vehicle connects to the BMW Group server or the driver calls up the service configuration manually.

In a statement, BMW said; "The online capability of BMW Group ConnectedDrive allowed the gap to be closed quickly and safely in all vehicles. There was no need for vehicles to go to the workshop.

“If you are worried that your vehicle may not have received the update (perhaps because it has been parked in an underground car park or other places without a mobile phone signal, or if its starter battery has been disconnected) then you should choose ‘Update Services’ from your car's menu."